Authentication, Authorisation and Secure Defaults · seed 1 · A4, ink-friendly. The answer key prints on its own page for grown-ups.

Who you are, then what you may do

Computing · Networks & Security · ages 21-22
Name ______________________   Date ____________

  1. Maya may read but not delete. Which question is that?

    • Authorisation
    • Authentication
    • Accounting

  2. Which question is authentication?

    • Who are you
    • What may you do
    • What is your password

  3. Passwords may be stored as plain text for speed.

    Circle one:   True   False

  4. What does the per-user salt add?

    • A second password you must memorize
    • A random extra per person
    • A hint shown on the login screen

  5. The login server cannot be reached. For a new request that needs the check, what should each part do?

    • Wave everyone through without proof
    • Stay at no until checks return
    • Allow the request if waiting takes long

  6. Why must the hashing method be deliberately slow?

    • Each guess costs time
    • Logins feel more important
    • Passwords become longer and stronger

  7. A signed-in owner opens a pay record outside their permitted scope. Which check failed?

    • Authentication; sign-in never happened
    • Encryption; traffic was not scrambled
    • Authorisation, identity already held

  8. A rota reader touches pay files it never needs. What changes?

    • It gains every file
    • Keep all access in case it helps later
    • It loses unneeded files and keys
LightMySky · lightmysky.comW1-mt_ofIiD4Bbpk-s1

Answer key

For grown-ups. Fold this page away before handing over the rest.

Who you are, then what you may do W1-mt_ofIiD4Bbpk-s1

  1. Authorisation · Limits after identity is known are authorisation, like the guest list.
  2. Who are you · Authentication checks identity before anything else is decided.
  3. False · Plain text hands every password to whoever steals the list.
  4. A random extra per person · The random extra makes each stored hash unique, so one calculation cannot be reused across people.
  5. Stay at no until checks return · Failing closed keeps a new request at no until the check returns.
  6. Each guess costs time · Slow hashes raise the cost of every guess without making weak passwords safe.
  7. Authorisation, identity already held · Identity held, so the broken part is the limit on what follows.
  8. It loses unneeded files and keys · Least privilege strips each unneeded touch and names the removal.
Worksheet · LightMySky